Two isolated VPCs (Department A and B) need separate on-prem links and workloads must resolve on-prem DNS via conditional forwarding while minimizing operational overhead. What should you do?

The correct option minimizes operational overhead while meeting the requirements. A Cloud DNS peering zone in Department A allows VMs in Department A to resolve DNS names from Department B's Cloud DNS. An outbound forwarding zone in Department B then forwards these requests (and Department B's own requests) to the on-premises DNS servers. This centralizes the on-prem DNS forwarding for both VPCs through Department B's Cloud DNS, avoiding the need for separate forwarding zones in each VPC for the same on-prem DNS. Maintaining separate on-prem links ensures network isolation as required. Customizing OS DNS config on each VM is high operational overhead. Keeping VPCs isolated with separate Cloud DNS private and forwarding zones duplicates the forwarding configuration for the same on-prem DNS. Peering VPCs and routing all on-prem connectivity via a single VPC violates the requirement for separate on-prem links.